Search code examples
reactjsgoogle-chromeazure-ad-msalsamesite

How to remove warning about samesite in Chrome using a React App with msal Authentication


We have a react app and we are using msal authentication towards AAD. The first time the user logs in the application and we call acquireTokenSilent to aquire the token, we get this warning

enter image description here

we tried to call : document.cookie = "cross-site-cookie=bar, SameSite=None, Secure";

but we continue to get this warning.

When the app is deployed in an azure service it's even worse. acquireTokenSilentreturns a ClientAuthError Token renewal operation failed due to time out. If the user refreshes the page then it acquires the token and the warning goes away.

How we can remove this warning? Is the ClientAuthError that we get related to this warning (this happens only after we get this warning)?


Solution

  • Login.microsoftonline.com and login.live.com were updated late 2019 to correctly set the SameSite=None flag on the cookies required for cross domain requests. We have many other cookies that are not required cross-domain, however, and those are left untagged to reduce the amount of changes we put into a live system. This can cause some warnings in the Chrome console, which you can safely ignore for the login.microsoftonline.com and login.live.com domains.